Probably the most important single privacy point is in my first sentence - I said “their (McDonald’s) data about you.” Of course it should be your data. Data that exists or is collected by your action or lack of action, or delay of action or plain existence should belong to you. And selling it off for free email should be … hmmm discouraged. Require a paper and wet ink sign off? Something

The actual drafting of these laws is … we need a GPL for privacy